CVE-2026-106495: @backstage/backend-defaults Improper Access Control in Backend Action Invocation
Summary
CVE-2026-106495: Backstage: Improper access control in backend action invocation. Affects @backstage/backend-defaults versions < 0.17.8. Fixed in 0.17.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @backstage/backend-defaults package is a core component of the Backstage framework, which is designed to streamline the development and management of software projects. It provides essential backend functionalities, including action invocation and service management. However, a vulnerability has been identified that allows authenticated users to invoke actions that should be restricted, potentially leading to unauthorized access and actions within the system.
Vulnerability Detail
The vulnerability arises from improper access control in the backend action invocation mechanism of the @backstage/backend-defaults package. Authenticated users can exploit this flaw to invoke actions that operators have configured to be excluded, thereby bypassing intended restrictions. While existing action permissions and downstream authorization checks remain in place, the ability to invoke restricted actions poses a security risk, as it could lead to unauthorized operations within the application.
How To Fix
Latest published version: 0.18.1 as of 22 Oct 2026
npm install @backstage/backend-defaults@0.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.17.8
This is the first release that contains the fix.
npm install @backstage/backend-defaults@0.17.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure until the package is updated, limit access to action invocation endpoints to trusted service callers. This can be achieved by implementing network-level restrictions or using API gateways to control access based on service identity.
Conclusion
In summary, CVE-2026-106495 is a moderate severity vulnerability in the @backstage/backend-defaults package that allows unauthorized action invocation due to improper access control. It is crucial to update to the patched version 0.17.8 to mitigate this risk. Until then, implementing access restrictions is recommended.
See every vulnerability recorded for @backstage/backend-defaults →
FAQ
CVE-2026-106495 is a vulnerability in the @backstage/backend-defaults package that allows authenticated users to invoke restricted actions due to improper access control.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential risks include unauthorized access to restricted actions, which could lead to data breaches or unintended modifications within the application.
You can update the package by running the command: npm install @backstage/backend-defaults@0.17.8 in your project directory.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software by analyzing the package-lock.json file. It provides real-time alerts for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for @backstage/backend-defaults.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
